Custom security provider exception

Question

Good day, colleagues. I want to raise an old topic.
I use custom security provider exceptions:
-AccountExpiredException
-AccountLockedException
However, the login() method only captures FailedLoginException
try
  CallbackHandler pwcall = new weblogic.security.URLCallbackHandler(user, pass.getBytes("UTF-8"));
  subject = weblogic.security.services.Authentication.login(pwcall);
  weblogic.servlet.security.ServletAuthentication.runAs(subject, request);
catch (javax.security.auth.login.LoginException e) {
  e.printStackTrace();
javax.security.auth.login.FailedLoginException: [Security:090304]Authentication Failed: User ...
  at weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl.login(LDAPAtnLoginModuleImpl.java:240)
  at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110)
  at java.security.AccessController.doPrivileged(Native Method)
I found similar questions IdentityAssertion custom exception, FailedLoginException asked many years ago for WLS 9.2
Their solution (wlp.propogate.login.exception.cause=true) does not work for WLS 10.3.
How to propagate original LoginException?
Or exception message only.

Answer 1

I did it! look closely to source code:
javax.security.auth.login.LoginContext:875
if (moduleStack[i].entry.getControlFlag() == AppConfigurationEntry.LoginModuleControlFlag.REQUISITE) {
  // if REQUISITE, then immediately throw an exception
  if (methodName.equals(ABORT_METHOD) || methodName.equals(LOGOUT_METHOD)) {
       if (firstRequiredError == null)
            firstRequiredError = le;
  } else {
       throwException(firstRequiredError, le);
} else if (moduleStack[i].entry.getControlFlag() == AppConfigurationEntry.LoginModuleControlFlag.REQUIRED) {
  // mark down that a REQUIRED module failed
  if (firstRequiredError == null)
       firstRequiredError = le;
} else {
  // mark down that an OPTIONAL module failed
  if (firstError == null)
       firstError = le;
javax.security.auth.login.LoginContext:922
// we went thru all the LoginModules.
if (firstRequiredError != null) {
  // a REQUIRED module failed -- return the error
  throwException(firstRequiredError, null);
} else if (success == false && firstError != null) {
  // no module succeeded -- return the first error
  throwException(firstError, null);
} else...
I set Control flag: OPTION to DefaultAuth (was REQUIRED)
and order it after my LoginModule. (restart required!)
Now I catch my exceptions %)